AccidentalEducationEducationMisconfigurationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDPIIMediumActive

AUBURN UNIVERSITY CREDIT UNION

bd_9db95af69b0c3ee1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 2, 2015

Filed

Apr 2, 2015

To disclose

4 weeks

Affected

179state residents only

Linked

4 filings

Confidence

66%

Full breach record for AUBURN UNIVERSITY CREDIT UNION →6 incidents on file

Auburn University notified the NH Attorney General of a data security event affecting 179 NH residents. Personal information (names, addresses, DOB, SSNs, emails, academic info) was inadvertently accessible on the internet since September 2014. Discovered March 2, 2015. Notices sent April 1, 2015. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 182 days

discovery → filing · 4 weeks / 31 days

Sep 1, 2014

Begins

Mar 2, 2015

Discovered

Apr 2, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_cc65841ecf7926c32015-04-02Candidate
South Carolina State AGbd_bb46a397be6f7f902015-04-06 · +4dVerified
Massachusetts State AGbd_13632d6f9ba9ec752015-04-07 · +5dVerified

Name: AUBURN UNIVERSITY CREDIT UNION
norm: auburn university credit union
Industry: education

Name: AUBURN UNIVERSITY CREDIT UNION
norm: auburn university credit union
Industry: education
Industry: Educationllm

Discovered: Mar 2, 2015
Breach occurred: Sep 1, 2014
Undetected for: 182 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2015
Affected individuals: 179state-resident count only
Data types: Identity (basic)Government IDPII
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Providing written notice of this incident to other state regulators, and to the national consumer reporting agencies

During the incident: Corrected this internal issue the day it was discovered
Retained independent forensics experts to identify the full extent of data implicated
Provided written notice of this incident to all potentially affected individuals
Offered access to two (2) free years of credit monitoring services
Provided each individual with information on how to protect against identity theft and fraud
Providing written notice of this incident to other state regulators, and to the national consumer reporting agencies
Changes made: Taken steps following this incident to increase our data security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGApr 2 · first

New Hampshire State AGApr 2 · first · this page

South Carolina State AG+4d

Massachusetts State AG+5d

Pattern: first filing Apr 2 (CA), last Apr 7 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/auburn-university-20150402.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2015
Raw hash: 346088a5c713ae53b717762fb87cfb74d46a0bfcdc1c54c5bb44f6a5c430064a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAUBURN UNIVERSITY CREDIT UNION

Victim entityAUBURN UNIVERSITY CREDIT UNION

Incidentdiscovered Mar 2, 2015

Stated responseCorrected this internal issue the day it was discovered

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov